31337 |3I2Ø\\|/53I25

Maybe it's time to create a thread to discuss the best schizo browser out there that does not call phone. Elaborate explanation followed by the most glitterboy answer possible can be found here: https://github.com/arkenfox/user.js/issues/1807 Another link you might consider is https://sizeof.cat/post/web-browser-telemetry/#google-chrome There is also spyware watchdog on neocities: https://spyware.neocities.org/articles/ Share more links if you know them. The idea here is to find browsers that do not simply "respect" privacy, but which have devs that actually understand what the word means. And then choose the best among them. I used to use IceCat, but then moved to LibreWolf. LibreWolf calls phone and as such it is not very clear what exactly devs mean by saying "LibreWolf is a privacy-focused and user-friendly browser based on Firefox". What the fuarrrk do they mean? You browser literally calls phone without any possibility to disable that crap even though I never need it on my for-imageboards browser. If I need to be a glitterboy, I'll be a glitterboy on firefox and contain my normalglitterboy activities to normalglitterboy software. I looked into IcaCat again and as expected from autisGNU, it is outdated. It follows firefox ESR 115 instead of moving on to ESR 128. On the other hand compiling it was almost straightforward. I looked into ungoogled-chromium but it must be compiled manually and holy fuarrrk give me a break, the last time I tried I gave up while figuring out dependencies and it's another ~20GB of wasted chroot space, and God forbid you contain it to a virtual machine, it's going to compile for days. On the other hand virtual machine can be paused or saved (i.e. save state on vbox). Unleash your wisdom onto me. But if you're a clueless glitterboy like me and came to get some self validation by throwing in useless replies go suck ass.

just use tor browser privacy is a red herring anonymity is the real goal https://anonymousplanet.org/

>>25072 Tor is overkill and is broken for many purposes. It is a drastic measure against substantial threats, what I want is browser that doesn't leak my behavioral patterns rent free to whoever wants to know it.

>>25071 After reading the lain webring threads, seems it's mentioned that Lynx terminal browsing is the only way to go if you want a so-called 'browser' not to phone home.

>>25072 And the best way is mobility and learn to soykafpost from mountain tops using a long high yagi antenna. Or daisy chain drones for tapping wifis in the next town over.

>>25074 This is bad isn't it? I wonder if I should try compiling ungoogled-chromium after all and then test it.

By the way what is the smartest way to check which connection an application makes in real time? I have a crude hack around firejail --dnstrace but it doesn't feel smart at all. People seem to be performing these tests like no big deal but I am completely clueless.

>>25073 its really not that inconvenient to use

> ~20GB of wasted chroot space, and God forbid you contain it to a virtual machine, it's going to compile for days. yeah, as Terry said, they aka nwo like to obscure & overcomplicate things on purpose. browsers became more complex than OS itself. so called The Internet committee , don't think about privacy & push for more unsafe browser api, web rtc etc standarts options a. write your own browser b. compile some one else's. and there are the options : [ HTML(5) only. but how about CSS, audio/video, webp, latest image specs, web API's; with js & all, but secured, sandboxed, hardened; cli-only ; ] The ideal would be written in Rust and modular like Linux kernel, where user can select different implementations of js runtime/v8. Or just abandon the cursed web for good, with it's broken DNS, SSL. Try Gemini, Gopher, web3, usenet. Even if you manage to get or write private browser, there could be leaks on os/hardware/network level. The last time I checked, there were no _>official<_ portableApps, appImages (or snaps/flatpaks) of those mentioned by you private browsers. The builds available out there you don't really want to trust.

>>25084 I can't entirely abandon web though, otherwise how would I post on lainchan? Writing your own is not feasible. Theoretically maybe raise funds and then write something tolerable, but who's going to carry out all the effort? Who's competent and willing at the same time? What I try to do is finding the lesser evil among what is already available. If that makes any sense. Does it? I don't know. I want to believe.

This covers a few features compared of some common ones https://privacytests.org/ IceCat is ideology first, privacy second, practicality last. It breaks websites if you just leave it with it's defaults. LibreWolf devs means small compromises for usability > Does LibreWolf make any outgoing connections? >Yes, but they aren't in any way privacy invading and they were carefully evaluated. Specifically they are needed to fetch and update the blocking lists used by uBO, Tracking Protection and certificate revocation, which we considered more important than disabling all outgoing connections, especially ones that are harmless. LibreWolf also maintains an open WebSocket towards Mozilla's push server to check wether you have received push notifications from websites you have subscribed to. >With that being said, LibreWolf is still committed to removing all privacy invading connections, and to keep all connections to the bare minimum required to maximize and balance privacy and security. https://librewolf.net/docs/faq/ It seems push notifications are off by default anyway. Mullvad browser is basically more or less just tor browser without the tor network and the devs work with the tor project so that is another alternative. You also can always just use FireFox with the ArkenFox configurations https://github.com/arkenfox/user.js One undermentioned security feature id recommend is setting download location to not be automatic but ask you every time. This helps prevent unwanted downloads by acting as a download confirmation.

>>25088 >Which browsers hide what's unique about your device? >Media query screen height >blah blah Letterboxing? How many people actually have it enabled, say, on LibreWolf? >Which browsers remove URL parameters that can track you? >__hsfp >blah blah What is it and how exactly do they prevent, under which circumstances and which settings affect that? >Which browsers block important known tracking scripts and pixels? What is this and how exactly is this implemented? Default uBlock Origin? Couldn't they make it more obscure?

>The idea here is to find browsers that do not simply "respect" privacy, but which have devs that actually understand what the word means. And then choose the best among them. I use Mullvad Browser because it is developed in collaboration with the Tor Project, and it seems obvious to me that as developers of the Tor Browser they have the best reputation and most experience when it comes to developing a private firefox-based browser

Also there is https://github.com/duckduckgo/duckduckgo-privacy-extension how many of the issues of i.e. ungoogled-chromium would it mitigate?

Mullvad Browser zero phone home schizo setup: - Turn off update check. Packagers might have taken care of this already. If not, touch "/opt/mullvad-browser/is-packaged-app" or echo '{ "policies": { "DisableAppUpdate": true } }' >> /opt/mullvad-browser/distribution/policies.json - If you want system DNS instead of Mullvad encrypted DNS: Settings > Privacy & Security > Enable secure DNS using: Off - Maybe turn off (not sure what this leaks if left on) Settings > Privacy & Security > Query OCSP responder servers to confirm the current validity of certificates - uBlock Origin settings > Filter lists tab > turn off "Auto-update filter lists" (Instead use the "Update now" button) - about:config: extensions.update.enabled false - Remove or disable Mullvad extension if you don't need it, Settings > Extensions & Themes Verify no connections on startup and idle with tcpdump -n or Wireshark

What do you think of this https://coveryourtracks.eff.org ? Librewolf and Cromite yield unique browser fingerprint, huh.

>25073 You're pretty dumb. Tor Browser is the only browser that doesn't leak fingerprints.

>>25094 It's not true. It's just blends you in with every other Tor user. But using Tor is a big red flag to most ISPs and most glowies who all have warrant-less back-ends. Anyways it's security through obfuscation. Even using ob4fs is not full proof. There are data miners who have a record of all bridges. So don't trust the Tor developers on this. They're naive. >>25092 This seems to be the best advice. OP should audit himself. Trust but verify. I recommend taking it one step further. Passive TAP your network cables from multiple points. A sophisticated enough adversary can obfuscate or hack your terminal outputs. Always audit from external clean systems rather then only auditing on the system you're auditing.

uBlock Origin kinda is like kicking dead whales down the beach it doesn't grant complete or good control default 'blocking' extension configs in some major browsers greenlight scripts from FAANG, white listing it by default. a while ago Chrome (& Mozilla probably) said they'll remove $blocking extension that block TOO MUCH and not comply. In exchange extension maintainers decided to ship extension builds, configs, that allow *good* privacy-respecting trackers & good privacy-respecting ads. >>25092 >>25088 whole point of those configs, lists is to write your own & maintain your own, offline, understanding how it works. ideally, reading source of browser with extension, understanding how it works. And not to pull some one else's configs from servers. But that's hard and time consuming, resource intensive task. Not everyone can do that. So people mindlessly trust and delegate their security to some 3rd party maintainer. 2 93 94 95 in the end, there are gazillion dollar organisations and departments spending billions to track member of a crowd like you, with thousands employees smarter than you, crafting honey tea for you. Those people been in industry for dozens of years, long before you learned how to use a pc. And they calculated your every step. What could you do, how can you resist? Alling capital EFF letters to single red herring dot from their logo

>>25096 Ive had issues with uBlock where im subscribed to a list but sometimes entries are not selected as being blocked from that list even if updated. I dont know what causes this. It is a good thing what Firefox is doing in the long run for the people at large but too bad they have too small a share of users to really make an impact manipulating companies to being more privacy respecting. Chrome's goal is the opposite since Google has it's own ads and is only trying to block out competition. > whole point of those configs, lists is to write your own & maintain your own, offline, understanding how it works. ideally, reading source of browser with extension, understanding how it works. And not to pull some one else's configs from servers. In a way but sometimes it just works. I do not know if it's still an issue but I once years back discovered a folder with thousands of small screenshots used for webpage thumbnails of pages I visited so I had edited the about:config to not take screenshots of pages. This was a huge bug i think since it didnt even clear old unused screenshots even after clearing browser history and cache.

>>.25071 >Maybe it's time to create a thread to discuss the best schizo browser out there that does not call phone. Tor Browser or Mullvad >why? cuz Librewolf is trash that have two adblockers uBlock Origin + Mozilla Enhanced Tracking Protection Librewolf also doesn't clear history by default https://librewolf.net/docs/faq/#does-librewolf-make-any-outgoing-connections >push notifications aka push services which is privacy invading lol https://librewolf.net/docs/faq/#why-is-session-restore-not-working lol thats why the latest release remembers history now lol

Firefox & Chrome is like Rep & Dem, Blue & Red. In the beginning of times, FF was really good altenrative to IE, when there was no Chrome around. And FF pioneered extensions. FF been #1 by the amount, usefullness of extensions & future SIMD bright. Chrome got first released then. Produced by highly skilled, highly payed employees by bigger than mozilla company with multimilion revenue. It required less ram, it was faster, js was faster there. New ver of FF breaks compatibility with old extensions abandoning them, making all hard earned user customization useless. (No suitable forks that maintained up to this day?) Using FF became useless & nonsence, everyone switched to Chrome, Chrome became #1 by choice & extension amound. World domination achieved. ############### where are you, thousands of Luke Smith followers, not campaining for something like surf what does the op says?

>>25101 The real reason Chrome is so widely used now is because it is the default on Android and because Windows switched to a Chromium based browser. Firefox would have been fairly equal usage if not for that since the browsers people always switched back and forth because one was always bettering the other. But yes things seemed to go downhill when Firefox broke extensions.

>>25103 >Chrome market share 66.6% (Paging Nick Land for numerology spergout) >Firefox is 2.6% I don't think it would be fairly equal in usage.. Obviously the bundling with stock soykafphones is huge but that is part of the game, you can't just dismiss it. India alone distributing android dreck among their dalits and chandalas would singlehandedly nuke firefox's market share

>>25101 >where are you, thousands of Luke Smith followers, not campaining for something like surf nvr heard of it before is a terminal based cringe one?

>>25103 Chrome did take off around 2011 when smartphones started going mainstream but Firefox has also been in definite decline.

>>25101 >what does the op says? Contact me when chromium allows you to change omnibar font size so I can actually read it and tab height so that lower half of the text doesn't get cut off. Chromium has some of the most degenerate UI I've ever seen, even modern firefox doesn't suck at all in comparison.

>>25071 pick an iceweasel (or emacs) of your flavor & コ ン 3 b o o t there are plenty of projects in need, become a maintainer freedom ain't free

>>25128 >become a maintainer And maintain what exactly? Your ass? I do what I can, but my capabilities are pretty limited. There is nothing I can do to help developing a good browser. One way or the other, it's the reality and I have to face it with what's available at hand.

>>25071 lynx vm routed through whonix-gateway, and run kloak on the host. of course the anonymity set is smaller here, but so is the attack surface. for js, whonix-qubes. qubes should render graphics via cpu rather than via hardware acceleration, so assuming perfect opsec sites shouldn't be able to fingerprint your hardware also. >>25105 surf is suckless's attempt at part of a browser. it's a browser but for a single page. can be combined with other programs for more functionality.

>>25143 I mentioned lynx earlier but have to say this advice is the best. It covers all browser requirements. Op should heed. >Kloak Mind sharing more about this? On the whonix page it mentions it's for keystroke fingerprinting protection, but not available on Qubes?

>>25144 >kloak introduces small, random delays between keystrokes. just enough to make it difficult for an adversary (usually via js) to fingerprint your typing patterns. ships with non-qubes-whonix. >qubes-whonix the current status of kloak (or similar) on qubes-whonix: https://github.com/QubesOS/qubes-issues/issues/1850 also see: https://www.whonix.org/wiki/Keystroke_Deanonymization#cite_note-6 links for anyone else that's interested: repo: https://github.com/vmonaco/kloak whonix docs: https://www.whonix.org/wiki/Keystroke_Deanonymization

>>25154 Thank you for triggering my ocd once again. I just blissfully forgot js had already pwned me years ago and now this again. I'm about to break my system installing kloak.

Every single browser except for Tor Browser leaves a unique fingerprint and allows to tie everything you do online. There's no other options.

>>25159 80% true statement but no you use Mullvad or other browser and mount your ~/.cache to tmpfs in fstab

>>25159 Yes. Without the massive mixing of users, all from the same IPs and same fingerprint, you'll be singled out as "that fingerprint resistant guy". >>25160 Not so sure. There's so much info exposed by JS APIs, you might not need persistence for a supercookie. https://www.deviceinfo.me/

>>25160 What with the landwhale pics? Is this psychological warfare?

>>25163 Was wondering the same thing. Not the warfare part, though.

can't we just delete the lines that phone home before compiling? I'm sure it's probably some unreadable purposefully obfuscated bs but shouldn't it be possible?

>>25077 Look into mitmproxy. Dig deeper has a guide for this, do a web search

>>25143 lynx is bad for anonymity, you're immediately unique because nobody else uses lynx. More secure though? Certainly.

DigDeeper blog has an hours long article chronicling the evil deeds of Mozilla. The sheer amount of doublespeak, privacy violations, anti-user pro-corp actions is funny when laid out in detail: https://digdeeper.club/articles/mozilla.xhtml Alt addresses for the blog: 5essxguxi5enurgtuquvrjuvikss4gc5lbhmtz57cq4cedqx5tqvaxqd onion @ tor dv2recs7spoc4vquwnt7gotljvot34i4am4xqsfslhfvdymgjfoa b32 i2p @ i2p >>25184 >can't we just delete the lines that phone home before compiling? We can, and I speculate Tor Browser (therefore Mullvad Browser) does some of that. Maintaining the patches is a job though. Mozilla's full time developers coding endlessly, introducing new tracking month after month, fueled by $500 million in corporate payoffs a year. And there's no use, 1. few run the forks, 2. at some point as humankind is getting frog-boiled, the kind of profile building tracking cancer that cannot be avoided, like Cloudflare, like black box operating systems and mobile apps, like proven AT&T mass wiretap, will be baked into the wired so deeply that deleting some client spyware is putting out a house fire with a toy water blaster. Arguably it already is this way. >>25242 Set User-Agent header to Chrome.

>>25242 true, but you can modify its headers (and potentially even the TCP socket options and the like) to match cURL. Hell, maybe rewrite its networking stack and replace it all with libcurl lol

>>25160 >>Mullvad Tor Browser without Tor is a pretty unique combination >>other browser and mount your ~/.cache to tmpfs in fstab You have no idea what you're talking about, that's absolutely irrelevant. The metadata your browser sends to a server is collected, sold and aggregated in tons of databases around the world. If it's unique, everything you do online can get tied together. You'll always stand out as that one weird guy who uses Mullvad Browser without Tor

>>25312 I'm dumb but wouldn't this not be a problem if you change your user agent and keep noscript on?

>>25313 At very least IP, HTTP headers, TLS fingerprint will get you doxxed

>>25314 Can't forget about your OS' TCP/IP stack fingerprint too

https://github.com/elpy1/tlsfp doesn't look like tls fingerprints are nearly as powerful as brr js hash of whatever. literally. js allows infinite possibilities of fingerprinting

Okay I schizoed out and installed mullvad browser because stupid librewolf wouldn't render an imageboard correctly. Letterboxing is annoying and I miss the noscipt and decentralities extension. Dunno how privacy good it is to install any extensions. Also installing additional dictionaries, because I type often in the browser. Definitely not good and they probably will fingerprint me by my typing patterns, huh. But I mostly post on imageboards, so spell checking is very welcome

When I'm not using Tor Browser, I use vanilla Firefox with a few very popular add-ons: noscript, ublock origin, and privacy badger. My reasoning is that if Firefox is good enough as a base for Tor Browser, it's good enough for me. And its popularity means it has less of a fingerprinting problem than its special security-oriented respins. Naturally, I go through settings and set everything possible to the most secure/private option for a generic threat model, including Mozilla itself..

Currently ideal practice is to use Palemoon. Remove the spyware (https://spyware.neocities.org/guides/palemoon), configure it to use TOR (optional, do it if you want to hide your IP) and install nMatrix (disable everything by default). Then disallow browser history, set to delete all cookies when the browser closes for extra security. The main thing weakness comes from your OPSEC practises. Sure you might have a super-secure TOR only setup if you are logged into your Google account (I assume 90% of people here don't have one, good) it's all null as you can be reliably tracked. Refrain from using privacy-violating services and generally strive towards doing everything locally. Keep in mind every-time you query a site (including embedding) you are giving them your HTTP header.

>>25412 Pale Moon uses custom dependencies which is an absolute security nightmare.

>>25413 Ah right they bundle their dependencies. Still unlike Firefox removing the spyware isn't an exercise in futility (while having access to addons such as nMatrix and LibRedirect). Maximum contain it as much as possible.

>>25396 Firefox isn't good enough there is simply no choice. Internet is doomed didn't you know

>>25162 >you'll be singled out as "that fingerprint resistant guy" This phrase sets a new standard for breathtaking stupidity.

>>25433 are you willfully refusing to understand what he means for the purpose of pedantry? why?

>>25071 I don’t get it, when the browser watches me entirely, does that mean that it has access to the device itself or just to obscure moviepages like watching hereditary with that table yelling scene, or just mainly up and downloads of coffee shop menue cards and alike?

>>25073 >Tor is overkill and is broken for many purposes. It is a drastic measure against substantial threats, what I want is browser that doesn't leak my behavioral patterns rent free to whoever wants to know it. Well... if you use a public DNS, you're fvcked. So either you use Tor or you could write a script for a daemon that changes your DNS at random, short intervals. The issue with a VPN alone is that all of your traffic goes through the VPN. That's a very centralised approach to hiding yourself; it's very vulnerable. So even if you use a VPN, you still best connect to it through Tor. So then why bother with the VPN? The only reason why you would use the VPN is to avoid getting blocked from certain websites. But these days, even VPNs get restricted and captcha flooded... So getting a VPS and self host a VPN and connect to it through Tor on a public wifi network, is the only sensible approach. I wouldn't route all of my traffic through there though. Only if you're doing naughty stuff would I fire up that system. For your regular day to day activities, I would just run vanilla Brave because it randomises your fingerprint and has good anti-tracking out of the box without you having to mess with the settings and potentially making your fingerprint more recognisable. On top of that, I would use a DNS randomiser. When you do your random daily activities, You don't need to hide your IP. You literally just want to appear like a random normal person that uses Brave. Keep in mind that you almost certainly have not a unique IP address. Your ISP will issue you an IP that you share with many other people. The key is just to not alert any triggers while you're using your normal person system so that no one has any reason to start snooping your ISP in order to get your identity. If you're gonna do some naughty searches or some naughty soykafposts, use the aforementioned system. Just compartimentalise your internet activity according to the potential threat level. It would also be wise to do your naughty stuff on different hardware.

>>25439 >Well... if you use a public DNS, you're fvcked All my DNS unironically goes through my VPNstupid mullvad VPN restricts DNS access through firewall so it kinda forces to use their own DNS, I don't know if it is configurable, most likely not, and their daemon is just so handy I don't want to fuarrrk around with wireguard/openvpn anymore because they're fuarrrking dumb. Openvpn is tolerable but wireguard... just fuarrrk this soykaf. So I'm basically fuarrrked yes, hope they don't care about me visiting some imageboards for losers haha Also chromium is evil so I lean to people who use mullvad browser. Also some people host bind9/bound/unbound locally with DNS caching, it's a good idea but it takes RAM and I just kinda don't care enough, because should anything come up, I just get back to tor browser

>>25455 >stupid mullvad VPN restricts DNS access through firewall For good reason, a website can easily find out your DNS server, if it's anything other than the VPN you're /marked/

>>25463 >a website can easily find out your DNS server how do they do that btw

>>25465 They run a DNS server and make your browser request a resource from a unique domain. Their server observes where the DNS query came from, which is your DNS server. It can be a new unique subdomain for each page load, like lainon5716.dnsleak.example.com. The backend has logic to connect the lainon5716 unique ID and your DNS IP to your session cookie or HTTP request. Standard Mullvad users use Mullvad DNS, this doesn't stand out. If you set 9.9.9.9 or whatever as DNS and use Mullvad for traffic, that will be a rare combination, therefore more identifying bits, easier to track across the web, this is why it's dumb to use custom DNS with a VPN.

>>25485 but that would need javascript running right? also am i correct that this works because most dns resolvers are recursive?

>>25488 it doesn't need JS, they can request a picture or a css from a static index.html >works because most dns resolvers are recursive yes, but how else would your dns server find a unique domain name not used on the internet before

>>25485 >If you set 9.9.9.9 imagine the ratio of In-Q-Tel[b/] sh*lled products lol even QANON finna be bussin on [b]Quad9 which is a intelligence product sold as DNS lol people gonna be shook when they realized they simped dis hard for skibidi toilet

>>25485 >If you set 9.9.9.9 imagine the ratio of In-Q-Tel sheelled products lol even QANON finna be bussin on Quad9 which is a intelligence product sold as DNS lol people gonna be shook when they realized they simped dis hard for skibidi toilet

>>25589 > Quad9 which is a intelligence product sold as DNS According to who?

>>25592 iykyk you dont even have to be teaking or touching grass to know this tea is valid quit being a techlore fanboy for one second i swear fr

Actually the only way with DNS is to host your own recursive resolver. With dnssec. And with caching. Querying the entire hierarchy, instead of using forwarder.

Wait are brave developers actually niggers or what? They advertise themselves pretty brightly.

>>25730 >muh sekurity brower >muh cryproshitt >ads for plebs >can't be build from source code >are they niggers??? you might be retarded https://spyware.neocities.org/articles/brave https://digdeeper.club/articles/browsers.xhtml#brave

>>25731 >you might be retarded i never once looked into brave though. skimmed their website a minute after making the >>25730 post and got the same greentext going though my head as yours. anyway it's easier to ask for sweet fruits than to toil for them yourself so thanks >spyware >digdeeper wish these sites were something new for me

>>25241 Is there a way to use mitmproxy for any application (rather than just internet browsers)?

>>25745 proxychains afaik since it hijacks system calls.

>>25745 you could use iptables to have certain rules route all traffic to your proxy, and drop all outgoing traffic not from the mitm process. you could also drop a library that hijacks system calls and route everything through mitmproxy first, but static binaries will ignore it

>>25745 these: >>25749 >>25756 also torsocks. both proxychains-ng and torsocks can be redirected to a dummy proxy are userland and can be configured to dump connection information. torsocks will block non-tcp traffic and a number of syscalls though. you could also bypass all of that and write your own. use the LD_PRELOAD trick and wrap connect(2) and sendto(2) calls to also print the target address/port to stderr

>>25074 But it can't read https so it's useless.

>>25785 Please provide evidence when talking out your ass https://en.m.wikipedia.org/wiki/Lynx_(web_browser)

Once something non-trivially more secure than firefox is made, that still allows me to use vimlike-controls, I'll switch to it. But most of these seem like marginal improvements, or like they'll break sites, or worst of all, they won't let me keyboard-only. Maybe I should just learn to code my own implementation of the extension.

>>25786 You are right. I used it a long time ago and when everything started using https it could not go there anymore so I stopped using it. Tried it again later and still didn't work. But I tried it now and it worked. Great!